3 ms·
Yes, this seems like some sort of card testing attempt. Glad most of the fraud was caught. Not sure if you’re the author, but I’d like to see how we could’ve he
by edwinwee 4y ago
Yes, this seems like some sort of card testing attempt. Glad most of the fraud was caught. Not sure if you’re the author, but I’d like to see how we could’ve helped better. Could you forward me your thread with support at edwin@stripe.com? Also, if you haven’t implemented them yet, I might recommend looking into CAPTCHA and rate limiting to help prevent future attempts.
- jstanley 4y agoThe author is a friend of mine but I've passed your comment on to him. Thanks!
- edwinwee 4y agoAppreciate it. Just connected with him.
- jamesfinlayson 4y agoI saw this happen recently and the account holder only got notified of the massive increase in transactions a day after the API key was cycled. I heard about this happening yet again too last month - August seems to have been the month of Stripe key leaks.
- edwinwee 4y agoWould suggest using webhooks to customize and trigger alerts (https://stripe.com/docs/webhooks https://stripe.com/docs/webhooks), or turning on payment notifications (https://support.stripe.com/questions/set-up-account-email-notifications https://support.stripe.com/questions/set-up-account-email-no...). But the best way to prevent this is to absolutely make sure secret keys are kept secret! We try to scour for leaks in the wild—and notify the owner directly—but can’t see everything.